# Kubernetes events

Kubernetes exports events through the API server. This input plugin lets you retrieve those events as logs and process them through the pipeline.

## Configuration

| Key                   | Description                                                                    | Default                                                |
| --------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------ |
| `db`                  | Set a database file to keep track of recorded Kubernetes events.               | *none*                                                 |
| `db.sync`             | Set a database sync method. Accepted values: `extra`, `full`, `normal`, `off`. | `normal`                                               |
| `interval_sec`        | Set the reconnect interval (seconds).                                          | `0`                                                    |
| `interval_nsec`       | Set the reconnect interval (sub seconds: nanoseconds).                         | `500000000`                                            |
| `kube_url`            | API Server endpoint.                                                           | `https://kubernetes.default.svc`                       |
| `kube_ca_file`        | Kubernetes TLS CA file.                                                        | `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` |
| `kube_ca_path`        | Kubernetes TLS ca path.                                                        | *none*                                                 |
| `kube_token_file`     | Kubernetes authorization token file.                                           | `/var/run/secrets/kubernetes.io/serviceaccount/token`  |
| `kube_token_ttl`      | Kubernetes token time to live, until it's read again from the token file.      | `10m`                                                  |
| `kube_request_limit`  | Kubernetes limit parameter for events query, no limit applied when set to `0`. | `0`                                                    |
| `kube_retention_time` | Kubernetes retention time for events.                                          | `1h`                                                   |
| `kube_namespace`      | Kubernetes namespace to query events from.                                     | `all`                                                  |
| `tls.debug`           | Debug level between `0` (nothing) and `4` (every detail).                      | `0`                                                    |
| `tls.verify`          | Enable or disable verification of TLS peer certificate.                        | `On`                                                   |
| `tls.vhost`           | Set optional TLS virtual host.                                                 | *none*                                                 |

In Fluent Bit 3.1 or later, this plugin uses a Kubernetes watch stream instead of polling. In versions earlier than 3.1, the interval parameters are used for reconnecting the Kubernetes watch stream.

## Threading

This input always runs in its own [thread](https://docs.fluentbit.io/manual/4.0/administration/multithreading#inputs).

## Get started

### Kubernetes service account

The Kubernetes service account used by Fluent Bit must have `get`, `list`, and `watch` permissions to `namespaces` and `pods` for the namespaces watched in the `kube_namespace` configuration parameter. If you're using the Helm chart to configure Fluent Bit, this role is included.

### Basic configuration file

In the following configuration file, the Kubernetes events plugin collects events every `5` seconds (default for `interval_nsec`) and exposes them through the [standard output plugin](https://docs.fluentbit.io/manual/4.0/data-pipeline/outputs/standard-output) on the console:

{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
service:
  flush: 1
  log_level: info
    
pipeline:
  inputs:
    - name: kubernetes_events
      tag: k8s_events
      kube_url: https://kubernetes.default.svc
      
  outputs:
    - name: stdout
      match: '*'
```

{% endtab %}

{% tab title="fluent-bit.conf" %}

```
[SERVICE]
  flush           1
  log_level       info

[INPUT]
  name            kubernetes_events
  tag             k8s_events
  kube_url        https://kubernetes.default.svc

[OUTPUT]
  name            stdout
  match           *
```

{% endtab %}
{% endtabs %}

### Event timestamp

Event timestamps are created from the first existing field, based on the following order of precedence:

1. `lastTimestamp`
2. `firstTimestamp`
3. `metadata.creationTimestamp`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fluentbit.io/manual/4.0/data-pipeline/inputs/kubernetes-events.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.